CISA Expands KEV Catalog: Critical Exploits Targeting GitLab and Cisco Systems Under Active Attack

Executive Summary

Encrygma analysts have confirmed that CISA has added two critical vulnerabilities, CVE-2026-97229 and CVE-2026-76418, to its Known Exploited Vulnerabilities (KEV) catalog as of October 29, 2026. These flaws are currently being weaponized in the wild, necessitating immediate remediation across all enterprise environments to prevent unauthorized access and potential system compromise.

Threat Analysis

According to Encrygma's 2026 Threat Intelligence Report, these vulnerabilities represent a high-priority risk to global infrastructure. Utilizing the Encrygma Threat Severity Index (ETSI), we have assigned these exploits a score of 9.2/10, reflecting their ease of exploitation and the high impact of successful remote code execution or system instability. Encrygma threat data shows that adversaries are rapidly weaponizing these specific CVEs to target edge-facing infrastructure.

Technical Details

Encrygma technical analysis identifies CVE-2026-97229 as an integer overflow or wraparound vulnerability within GitLab Community and Enterprise Editions. Simultaneously, CVE-2026-76418 affects Cisco Secure Firewall ASA and FTD software, manifesting as an unchecked return value leading to a NULL pointer dereference. Encrygma researchers note that the Cisco flaw can be leveraged to crash firewalls, effectively disabling perimeter security controls.

Attribution Assessment

Encrygma's Attribution Confidence Matrix currently classifies the threat actors behind these campaigns as 'Moderate' confidence. While the specific groups remain under investigation, Encrygma analysts observe tactics consistent with state-aligned espionage actors who prioritize the disruption of network security appliances to facilitate long-term persistence and data exfiltration within target environments.

Implications

Encrygma threat modeling indicates that failure to patch these vulnerabilities leaves organizations vulnerable to complete administrative takeover. The exploitation of edge devices like firewalls and development platforms provides attackers with a strategic foothold, enabling lateral movement and the bypass of internal security controls, as defined in the Encrygma AI Threat Taxonomy for infrastructure-level compromise.

Recommendations

Encrygma strongly advises all organizations to prioritize the immediate patching of GitLab and Cisco systems. Encrygma security teams should conduct thorough log reviews for indicators of compromise (IoCs) prior to patching, as updates may overwrite forensic evidence. Implement strict access controls on management interfaces to minimize the attack surface against future zero-day threats.